CVE-2022-23307: Apache Chainsaw

High severity, CVSS 8.8. EPSS: 54.4% chance of exploitation in the next 30 days.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Affected products

  • Apache Chainsaw: before 2.1.0 (fixed in 2.1.0)
  • Apache LOG4J: from 1.2, before 2.0 (fixed in 2.0)
  • Oracle Advanced Supply Chain Planning: version 12.1 only; version 12.2 only
  • Oracle Business Intelligence: version 5.9.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Business Process Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Communications Eagle FTP Table Base Retrieval: version 4.5 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Messaging Server: version 8.1 only
  • Oracle Communications Network Integrity: version 7.3.6 only
  • Oracle Communications Offline Mediation Controller: before 12.0.0.4.4 (fixed in 12.0.0.4.4); version 12.0.0.5.0 only
  • Oracle Communications Unified Inventory Management: version 7.4.1 only; version 7.4.2 only
  • Oracle E-Business Suite Cloud Manager And Cloud Backup Module: before 2.2.1.1.1 (fixed in 2.2.1.1.1); version 2.2.1.1.1 only
  • Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
  • Oracle Financial Services Revenue Management And Billing Analytics: version 2.7.0.0 only; version 2.7.0.1 only; version 2.8.0.0 only
  • Oracle Healthcare Foundation: version 8.1.0 only
  • Oracle Hyperion Data Relationship Management: before 11.2.8.0 (fixed in 11.2.8.0)
  • Oracle Hyperion Infrastructure Technology: before 11.2.8.0 (fixed in 11.2.8.0)
  • Oracle Identity Management Suite: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Identity Manager Connector: version 11.1.1.5.0 only
  • Oracle Jdeveloper: version 12.2.1.3.0 only
  • Oracle Middleware Common Libraries And Tools: version 12.2.1.4.0 only
  • Oracle MySQL Enterprise Monitor: up to and including 8.0.29
  • Oracle Retail Extract Transform And Load: version 13.2.5 only
  • Oracle Tuxedo: version 12.2.2.0.0 only
  • Oracle WebLogic Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only; version 14.1.1.0.0 only
  • and 1 more

Published 2022-01-18. Last modified 2026-06-17.